Lending firms in Kenya risk significant financial penalties for unlawfully disclosing customer financial information, as a recent ruling by the Office of the Data Protection Commissioner (ODPC) demonstrates.

• A lender was ordered to pay Ksh 200,000 in compensation for sharing a borrower's sensitive financial data without consent.
• The complaint, ODPC Complaint No. 1966 of 2024, involved the disclosure of payslips, bank statements, and identification documents to unauthorized third parties including another bank and the borrower's colleagues.
• The ODPC found the lender failed to establish any lawful basis under Section 30 of the Data Protection Act 2019 for processing and disclosing the data, leading to the penalty.